Executive brief
openframe-glslviewer is an extension that adds shader support to the Openframe digital display platform. The extension downloads executable files over unencrypted HTTP connections, allowing an attacker with network access to intercept and replace the executable with malicious code, leading to full system compromise.
Technical details
The vulnerability is an insecure download issue (CWE-269, CWE-311) where openframe-glslviewer retrieves executables over unencrypted HTTP rather than HTTPS. An attacker with a privileged network position (man-in-the-middle) can intercept the HTTP response and substitute a malicious executable, achieving arbitrary code execution on the host system. No authentication or special privileges are required from the attacker's perspective—only network-level access (e.g., shared WiFi, compromised ISP, or nation-state level capability). The package has not been updated since 2014 and no patch is available.
Affected products
- OpenframeProject openframe-glslviewer through 0.2.8
Timeline
- 2019-02-18: disclosed